NETWORK INFRASTRUCTURE VALIDATION OF NETWORK MANAGEMENT FRAMES

• US 20090235077A1
• Filed: 04/27/2009
• Published: 09/17/2009
• Est. Priority Date: 10/16/2003
• Status: Active Grant

• Current Assignee: Ajit Sanzgiri, Mark Krischer, Nancy Cam Winget, Pauline Shuen, Sheausong Yang, Timothy Olson
• Original Assignee: Ajit Sanzgiri, Mark Krischer, Nancy Cam Winget, Pauline Shuen, Sheausong Yang, Timothy Olson
• Inventors: Shuen, Pauline, Krischer, Mark, Olson, Timothy, Cam Winget, Nancy, Sanzgiri, Ajit, Yang, Sheausong
• Granted Patent: US 8,191,144 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A detection-based defense to a wireless network. Elements of the infrastructure, e.g., access points or scanning-only access points, detect intruders by detecting spoofed frames, such as from rogue access points. Access points include a signature, such as a message integrity check, with their management frames in a manner that enables neighboring access points to be able to validate the management frames, and to detect spoofed frames. When a neighboring access point receives a management frame, obtains a key for the access point sending the frame, and validates the management frame using the key.

Claims

1. A method for validating network management frames, comprising:

receiving a management frame with a source address identifying a source of the management frame and a destination address identifying at least one destination device on a first interface;

obtaining a key for the source of the management frame from an authentication server accessible via a second interface; and

validating the management frame using the key;

wherein the device validating the management frame is not a destination device identified by the destination address.

2. The method of claim 1, wherein obtaining a key further comprises:

authenticating with a security server on the network; and

receiving the key from the security server.

3. The method of claim 1, wherein obtaining a key further comprises:

authenticating with a security server on the network; and

receiving the key from a device that has been authenticated by the security server.

4. The method of claim 3, wherein the device is the source for the management frame.

5. The method of claim 1, further comprising:

obtaining a new key for the source after a rekey request; and

validating subsequent management frames using the new key.

6. The method of claim 1, the management frame further comprising a signature, the validating step further comprising validating the signature.

7. The method of claim 6, the signature further comprising a time stamp.

8. The method of claim 6, the signature further comprising a sequence number.

9. The method of claim 6, the signature further comprising a time stamp and a sequence number.

10. The method of claim 9, wherein validating further comprises determining the management frame is invalid when the timestamp is older than a predetermined criteria.

11. The method of claim 6, wherein the signature is contained within an information element appended to the management frame.

12. The method of claim 1, wherein the management frame is one of a beacon, a probe request, a probe response, an association request, an association response, Deauthentication, Authentication and Disassociation.

13. The method of claim 1, wherein the source is a neighboring access point.

14. An access point, comprising:

a wireless transceiver;

a controller coupled to the wireless transceiver for controlling the wireless transceiver; and

a second transceiver coupled to a network;

wherein the controller is responsive to the wireless transceiver receiving a management frame comprising a source address of a second access point addressed to a wireless client to communicate with a device via the second transceiver to obtain a key for validating management frames sent by the second access point;

wherein the controller is configured for validating the management frame with the key; and

wherein the access point is not the wireless client addressed by the management frame.

15. The access point set forth in claim 14, wherein the control is further configured to authenticate with a security server on the network;

and

the controller is configured to receive the key from the security server via the second transceiver.

16. The access point set forth in claim 14, wherein the controller is further configured to authenticate with a security server on the network;

and

the controller is configured to receive the key from a device that has been authenticated by the security server via the second interface.

17. The access point set forth in claim 16, wherein the device is the source for the management frame.

18. The access point set forth in claim 14, wherein the controller validates the management frame by validating an information element comprising a message integrity check within the management frame with the key for validating management frames.

19. A method of operation for an authentication server, comprising:

establishing a first secure communication session with a first access point;

establishing a second secure communication session with a second access point;

receiving a request from the second access point for a key for validating management frames sent by the first access point via the second secure communication session;

sending the key for validating management frames by the first access point to the second access point via the second secure communication session;

determining the first access point has changed the key for validating management frames to an updated key; and

automatically sending the updated key to the second access point via the second secure communication session responsive to determining the first access point has changed the key for validating management frames to an updated key.

20. The method of claim 19, wherein the receiving a request further comprises receiving a plurality of requests are received from a plurality of access points for a key for validating management frames sent by the first access point via a plurality of secure communication sessions corresponding to the plurality of access points;

and

wherein the automatically sending the updated key further comprises automatically sending the updated key to the plurality of access points via the plurality of secure communication sessions corresponding to the plurality of access points responsive to determining the first access point has changed the key for validating management frames to an updated key.

21. The method of claim 20, further comprising storing an identifier that identifies the plurality of access points requesting the key for validating management frames sent by the first access point.

22. The method of claim 19, wherein the second secure communication is established before sending the key for validating management frames by the first access point.

23. The method of claim 19, further comprising assigning the key key for validating management frames sent by the first access point.

24. An apparatus, comprising:

an authentication server configured to communicate via a network to a plurality of access points;

wherein the authentication server is configured to establish a first secure communication session with a first access point;

wherein the authentication server is configured to establish a second secure communication session with a second access point;

wherein the authentication server is configured to receive a request from the second access point for a key for validating management frames sent by the first access point via the second secure communication session;

wherein the authentication server is responsive to receiving the request from the second access point to send the key for validating management frames for the first access point to the second access point via the second secure communication session;

wherein the authentication server is configured to determine that the first access point has changed the key for validating management frames to an updated key; and

wherein the authentication server is responsive to determining the first access point has changed the key for validating management frames to an updated key to automatically send the updated key to the second access point via the second secure communication session.

25. The apparatus set forth in claim 24,

wherein the authentication server is configured to maintain a list of access points requesting the key to validate management frames sent by the first access points;

and

wherein the authentication server is responsive to determining the first access point has changed the key for validating management frames to an updated key to automatically send the updated key to the plurality of access points.